A network element (such as a router or switch) transmits and receives network data using one or more ports of that network element. Each of these ports has a physical link speed that limits the rate at which the network data can be transmitted from that port. The network element uses one or more queues to store the network data that is to be transmitted from one of the ports of the network element. The maximum data that a queue stores is based on the available buffer memory and a buffer configuration for that queue.
A problem called congestion can occur for network data transmission by the network element when the amount of network data that is to be transmitted by one of the ports is greater than the port and the associated queue can handle. In particular, congestion for a port occurs when network data cannot be transmitted through a port because the queue for that port is full and impairs the enqueueing of subsequent data. When congestion happens on a port, a system administrator would like to know the following information: (i) when did the congestion occur; (ii) what caused the congestion; and (iii) what is affected by the congestion.
Currently, a network element determines that congestion has occurred by counting the number of packets that have been dropped or marked as a result of congestion. For example, the network element polls dropped packet counters for each queue to determine the number of packets dropped on that port. The number of dropped packets for a port over a period of time can be an indication that congestion occurred. However, the polling period can be too large to adequately determine the answers to the three questions above. For example, a network element can have a polling period of the dropped packet counters can be on the order of tens of seconds (e.g., 45 seconds). With this large polling time, detecting when congestion occurs can be tens of seconds in the past, and make it difficult to determine what caused the congestion and also what is affected by the congestion. In addition, microbursts of congestion may not be detected if the burst does not cause congestion that results in dropped or marked packets. In addition, an administrator does not have access to information that indicates which network element marked a packet as a result of congestion, when the packet was marked or dropped due to congestion, or why a packet was marked or dropped due to congestion.